Critical severity · published Sep 28, 2026
CVE-2026-81867
Deserialization of Untrusted Data in Application Integration allows Remote Code Execution
9.4
CVSS
0.4%
EPSS
No
On KEV
Description
A Deserialization of Untrusted Data vulnerability in the JavaScript Task in Google Cloud Application Integration versions prior to 2026-06-28 on Google Cloud Platform allows an authenticated user with standard permissions to run arbitrary code on the shared production servers using a specially crafted script bypassing param guards.
This vulnerability was patched on 28 June 2026, and no customer action is needed.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
Application Integration · Google Cloud
before 2026-06-28 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-81867
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-81867
docs.cloud.google.com
https://docs.cloud.google.com/support/bulletins#gcp-2026-065
docs.cloud.google.com
https://docs.cloud.google.com/application-integration/docs/security-bulletins#gcp-2026-065
More from Application Integration
9.4
CVE-2026-19759
Incorrect Authorization in Application Integration allows Internal Stubby RPC Execution
9.3
CVE-2026-12710
Missing Authorization in Application Integration QueryEngineTask
8.3
CVE-2026-81375
Confused Deputy in Application Integration allows Internal File Read
7.3
CVE-2026-85298
Improper Authorization in Google Cloud Application Integration Leads to Privilege Escalation